Appendix D. A recommended rollout

  1. Pilot server. Install, licence, certificates, AD, SMTP, syslog, security, backups (chapter 5).
  2. Labels. Agree on three to five labels with the business. Create them, order them, add markings (8.14 has a worked example).
  3. Pilot group. Create a group for 10–20 pilot machines (chapter 9). Deploy agents there (chapter 12).
  4. Recommend first. Add classification rules from templates as Recommend. Watch the Audit Log and the Sensitive Data Detection report for a week.
  5. Turn on enforcement step by step. Require labels on send, then on save; add Enforce rules for data you are sure about; add Warn rules where users need a nudge.
  6. AI. Teach your document types with 20+ examples each, run rules in test mode, review the AI Classification report, then switch to recommend (section 11.13).
  7. Screen and print protection for the most sensitive label: screen watermark, screen capture protection, print trace.
  8. Roll out group by group. Use the Overview’s agent version, policy drift and add-in coverage widgets to follow progress.
  9. Operate. Weekly: alerts, Security & Tamper report, backups. Monthly: Executive Summary, licence and certificate expiry.